69fab0e87cf9d7bf1b6d76194e509c528404fa748a56c56ca0c3c0bc820abedd

Sharing

Copy URL Twitter E-mail

General

Target

69fab0e87cf9d7bf1b6d76194e509c528404fa748a56c56ca0c3c0bc820abedd
Size

507KB
MD5

5068b57373be1bb2957efb7491982370
SHA1

b638cc32531bc07a2920c500ed3a95217f1145ed
SHA256

69fab0e87cf9d7bf1b6d76194e509c528404fa748a56c56ca0c3c0bc820abedd
SHA512

43010b506de7a75745e520a9aa4ed428c13d9cd68cf1d01ea980fddd009fd04638f48a9d94fca160558c1fdf1072f197a2361b893c08c6060e523478e4183c03
SSDEEP

12288:KxrEMhTP1oqN3OWy3onNCGgLXGHnxXi9sV:KxrNhThglCi9k

Score

N/A

Malware Config

Signatures

Files

69fab0e87cf9d7bf1b6d76194e509c528404fa748a56c56ca0c3c0bc820abedd
.exe windows x86

cd625d88e2a9fd41b5adb57b2239d04c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHBindToParent
SHGetDesktopFolder

advapi32

LsaFreeMemory
LsaClose
RegEnumValueW
ReportEventW
RegisterServiceCtrlHandlerExW
RegSetValueExW
QueryServiceConfigW
AddAccessAllowedAce
ChangeServiceConfigW
RegEnumKeyExW
RegDeleteKeyW
GetUserNameW
SetServiceStatus
SetFileSecurityW
StartServiceW
ImpersonateNamedPipeClient
FreeSid
LsaOpenPolicy
CloseServiceHandle
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyW
LogonUserW
SetSecurityDescriptorSacl
LsaRetrievePrivateData
QueryServiceStatus
SetSecurityDescriptorOwner
RegConnectRegistryW
GetLengthSid
LsaOpenSecret
InitializeAcl
AccessCheck
GetNamedSecurityInfoW
SetSecurityDescriptorDacl
AddAce
SetNamedSecurityInfoW
AllocateAndInitializeSid
RegCloseKey
RegDeleteValueW
LsaNtStatusToWinError
RegisterEventSourceW
CopySid
RegOpenKeyExW
RevertToSelf
ImpersonateLoggedOnUser
SetSecurityDescriptorGroup
RegEnumKeyW
InitializeSecurityDescriptor
RegOpenKeyA
ControlService
LsaSetSecret
GetSecurityDescriptorLength
RegQueryInfoKeyW
OpenServiceW
LsaCreateSecret
DeregisterEventSource
OpenThreadToken
OpenSCManagerW

ole32

StgPropertyLengthAsVariant
CoFileTimeNow
PropVariantClear
GetClassFile
CoUninitialize
PropVariantCopy
FreePropVariantArray
StgOpenStorage
StringFromGUID2
CoTaskMemAlloc
StgConvertVariantToProperty
PropSysAllocString
CoGetClassObject
CoInitializeEx
CoFreeUnusedLibraries
CreateBindCtx
CLSIDFromString
CoSetProxyBlanket
CoCreateInstance
CreateStreamOnHGlobal
PropSysFreeString
CoTaskMemFree
StgConvertPropertyToVariant

kernel32

LCMapStringW
SetFilePointer
CompareFileTime
GetFileAttributesExW
CloseHandle
GlobalFree
ResetEvent
ReadProcessMemory
GetDiskFreeSpaceExW
PeekNamedPipe
DeleteCriticalSection
CompareStringW
FreeLibrary
SleepEx
RemoveDirectoryW
GlobalUnlock
InitializeCriticalSectionAndSpinCount
GetSystemTime
HeapFree
GetUserDefaultLCID
GetCPInfo
OpenEventW
OpenFileMappingW
SetLastError
QueueUserAPC
FindFirstFileW
DuplicateHandle
GetSystemInfo
WaitNamedPipeW
SetEndOfFile
WideCharToMultiByte
GetThreadLocale
SetPriorityClass
InterlockedExchange
SwitchToThread
ReadFileEx
GetSystemPowerStatus
VirtualFree
GetLocaleInfoW
lstrlenA
SetFileAttributesW
GetTickCount
WriteFileEx
GetThreadPriority
FileTimeToSystemTime
FlushFileBuffers
OpenProcess
ResumeThread
InterlockedIncrement
LocalFree
GetLongPathNameW
SetProcessWorkingSetSize
SetErrorMode
IsDBCSLeadByteEx
FlushViewOfFile
ReleaseMutex
FoldStringW
GetACP
GetDiskFreeSpaceW
WaitForMultipleObjects
GetCurrentProcess
EnterCriticalSection
IsBadWritePtr
ConnectNamedPipe
CancelIo
DeviceIoControl
TryEnterCriticalSection
GetModuleFileNameW
GetProcAddress
GetLocalTime
GetThreadTimes
GetCurrentDirectoryW
GetSystemDefaultLCID
HeapDestroy
SetThreadPriority
HeapAlloc
CreateNamedPipeW
CreateThread
CreateMutexW
LoadLibraryA
GetExitCodeProcess
GetSystemTimeAsFileTime
FormatMessageW
ExpandEnvironmentStringsW
TransactNamedPipe
GetStringTypeW
FindClose
CreateFileMappingW
SystemTimeToFileTime
IsValidLocale
GetDriveTypeW
VirtualUnlock
SearchPathW
CreateFileW
SetThreadLocale
GetCalendarInfoW
GetLastError
MapViewOfFile
WaitForMultipleObjectsEx
FindNextFileW
GetSystemDirectoryW
GetComputerNameW
GetVersionExW
GetCurrentThread
LoadLibraryExW
GetCurrentProcessId
GetFileSize
WriteFile
WaitForSingleObject
MultiByteToWideChar
LeaveCriticalSection
DisconnectNamedPipe
GetLogicalDrives
ReadFile
SetCurrentDirectoryW
LocalFileTimeToFileTime
CreateDirectoryW
WaitForSingleObjectEx
GetVolumeInformationW
LocalAlloc
HeapCreate
QueryPerformanceCounter
DeleteFileW
GlobalLock
CreateEventW
QueryDosDeviceW
GetFileAttributesW
GetOverlappedResult
UnmapViewOfFile
SetEvent
HeapSize
InterlockedDecrement
SetNamedPipeHandleState
GlobalAlloc
SetUnhandledExceptionFilter

msvcrt

_wcsupr
isxdigit
_ultow
wcscmp
swscanf
towupper
??1type_info@@UAE@XZ
_CxxThrowException
?terminate@@YAXXZ
_itow
wcsstr
_ftol
fgets
wcsncmp
__dllonexit
memmove
__CxxFrameHandler
wcstol
strtoul
toupper
swprintf
wcstod
_wfopen
strchr
_except_handler3
strcspn
realloc
wcsrchr
wcschr
_wcsicmp
wcscpy
_initterm
sprintf
_stricmp
wcstoul
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
wcsncpy
_errno
_wsplitpath
wcslen
_strnicmp
malloc
towlower
wcscat
_wcsnicmp
fclose
_adjust_fdiv
strncpy
wcstombs
_onexit
qsort
iswalpha
mbstowcs
isdigit
_wcslwr
isalpha
bsearch
free
wcsspn
??3@YAXPAX@Z
wcscspn
iswdigit
iswspace

ntdll

NtFsControlFile
NtOpenThreadToken
NtCreateFile
NtWaitForSingleObject
NtQueryVolumeInformationFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtNotifyChangeKey
NtQuerySystemTime
RtlUpcaseUnicodeChar
NtOpenProcessToken
NtOpenKey
NtOpenFile
RtlFreeHeap
NtCancelIoFile
NtNotifyChangeDirectoryFile
RtlDosPathNameToNtPathName_U
RtlUnicodeStringToOemString
RtlInitAnsiString
RtlInitUnicodeString
NtCreateEvent
NtQueryDirectoryFile
RtlQueryRegistryValues
NtQueryInformationProcess
NtDuplicateToken
NtQuerySystemInformation
RtlCaptureStackBackTrace
RtlOemStringToUnicodeString
NtClose
NtQueryInformationToken
NtSetInformationFile
NtQuerySecurityObject
NtQueryInformationFile

rpcrt4

CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
IUnknown_AddRef_Proxy
NdrDllGetClassObject
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
NdrOleAllocate
NdrDllUnregisterProxy
NdrOleFree
UuidFromStringW
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect

user32

TranslateMessage
RegisterDeviceNotificationW
UnregisterDeviceNotification
PeekMessageW
GetLastInputInfo
MsgWaitForMultipleObjects
DispatchMessageW
wsprintfW

Sections

.9618ds
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.B^br5
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.@#RFER
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.N^UHQt
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.h46asrg
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.64h4aer
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cd625d88e2a9fd41b5adb57b2239d04c

Headers

File Characteristics

Imports

shell32

advapi32

ole32

kernel32

msvcrt

ntdll

rpcrt4

user32

Sections

.9618ds Size: 2KB - Virtual size: 1KB

.B^br5 Size: 512B - Virtual size: 2B

.@#RFER Size: 171KB - Virtual size: 170KB

.N^UHQt Size: 58KB - Virtual size: 57KB

.h46asrg Size: 176KB - Virtual size: 175KB

.64h4aer Size: 97KB - Virtual size: 97KB

.9618ds
Size: 2KB - Virtual size: 1KB

.B^br5
Size: 512B - Virtual size: 2B

.@#RFER
Size: 171KB - Virtual size: 170KB

.N^UHQt
Size: 58KB - Virtual size: 57KB

.h46asrg
Size: 176KB - Virtual size: 175KB

.64h4aer
Size: 97KB - Virtual size: 97KB